Forum Discussion

James Selix's avatar
James Selix
Copper Contributor
Apr 06, 2017

WSUS 4.0 and Windows 10 Enterprise 1607 and Windows Updates; GPO to fully control updates??

So does anyone know how we can fully control windows updates and office 2016 updates via WSUS and still allow Windows Store updates from microsoft? These policies seem to be directly related and reli...
Matt Dunleavy's avatar
Matt Dunleavy
Copper Contributor
May 28, 2017

Hi James,

 

Well my worst fear happened and the creators update installed on my computer with out asking me to install it, and I haev not approved it in WSUS.

 

I have read various stuff on the internet and posted on reddit forums.

 

There are articles that seem to say that certain GPO settings don't apply when your using WSUS and windows 10 and are more designed for Windows machines that get updates online.

 

See here: https://blogs.technet.microsoft.com/windowsserver/2017/01/09/why-wsus-and-sccm-managed-clients-are-reaching-out-to-microsoft-online/

 

In particular "We also recommend that you do not use these new settings with WSUS/SCCM."

 

In additon, I have found another site talking about "Dual scan" where its checking online  for updates

 

https://blogs.technet.microsoft.com/wsus/2017/05/05/demystifying-dual-scan/

 

Your GPO is very similar to mine. I have the same options set. However, I am going to change the following (which is set how yours is): 

 

ENABLE: Never attempt to download payload from Windows Update

DISABLE: Download repair content and optional features directly from Windows Update instead of Windows Server Update Services (WSUS)

100 (BITS DOWNLOADS): Download Mode

 

Resources